Skip to content

v0.8.0

Latest
Compare
Choose a tag to compare
@HikaruEgashira HikaruEgashira released this 06 Jul 05:49

v0.8.0 Release

🚀 Major Features

Enhanced Call Graph Construction and Visualization

  • Call graph construction and visualization system - comprehensive analysis of function calls and references
  • Unified calls and references system - integrated tracking of code relationships
  • Tree-sitter query migration - replaced regex patterns with tree-sitter queries for better code analysis
  • Pattern-based vulnerability analysis - streamlined detection with improved accuracy

Improved CLI Architecture

  • Cobra-style CLI architecture - restructured command-line interface for better user experience
  • Graph subcommand - separated call graph generation into dedicated subcommand
  • TOML configuration file support - enhanced configuration management
  • Debug mode enhancements - improved troubleshooting capabilities

Performance & Scalability Improvements

  • Parallel processing capacity increases - significantly faster analysis for large repositories
  • Comprehensive timeout handling - improved reliability for enterprise-scale analysis
  • Benchmark validation system - extensive testing against real-world vulnerabilities
  • Performance benchmark tests - Node.js, Django, and Spring Boot specific optimizations

Extended Language and Framework Support

  • PHP language support - comprehensive PHP vulnerability detection
  • Terraform support - Infrastructure as Code security analysis
  • Custom API base URL support - flexible endpoint configuration
  • Multi-architecture Docker builds - improved container deployment

🔧 Improvements

Developer Experience

  • Comprehensive test suite - extensive unit and integration tests
  • Benchmark feature flag - exclude API tests by default for faster local testing
  • Real-world benchmark validation - tested against validation-benchmarks repository
  • Improved error handling - better feedback and recovery mechanisms

Analysis Quality

  • PAR model classification enhancements - improved Principal-Action-Resource detection
  • Enhanced pattern detection - better capture of full definitions and references
  • Built-in patterns updates - comprehensive patterns for all supported languages
  • Prompt optimizations - refined LLM analysis prompts for better accuracy

Configuration & Customization

  • Custom pattern loading - support for vuln-patterns.yml configuration
  • Environment variable controls - PARSENTRY_DISABLE_V1_PATH for custom endpoints
  • Flexible output processing - organized reports module structure
  • API key authentication fixes - resolved custom URL authentication issues

🐛 Bug Fixes

  • Fixed compiler warnings by properly handling unused fields
  • Resolved Django benchmark test compilation errors
  • Fixed edge count inconsistencies in call graph generation
  • Improved call graph function call extraction
  • Fixed tree-sitter predicate evaluation in pattern matching
  • Resolved Rust definition query issues
  • Fixed locale support and compilation errors
  • Improved principal detection accuracy

📄 Migration Notes

Breaking Changes

  • CLI structure has been reorganized to cobra-style architecture
  • Graph functionality moved to dedicated subcommand
  • Pattern format updated to tree-sitter queries

New Capabilities

  • Call graph construction and visualization
  • PHP language analysis
  • Terraform Infrastructure as Code analysis
  • Custom API endpoint configuration
  • TOML configuration files

🛠️ Usage Examples

# Generate call graph with visualization
parsentry graph --root /path/to/project --output-dir ./graphs

# Analyze PHP project
parsentry --root /path/to/php/project --output-dir ./reports

# Use custom API endpoint
export PARSENTRY_DISABLE_V1_PATH=true
parsentry --root /path/to/project --api-base-url https://custom.api.com

# Load custom patterns
parsentry --root /path/to/project --patterns ./vuln-patterns.yml

# Run with comprehensive benchmarks
cargo test --features benchmark

🔍 Architecture Improvements

  • Modular reports processing - organized output generation
  • Pattern-based analysis - improved detection methodology
  • Tree-sitter integration - enhanced parsing capabilities
  • Unified reference tracking - comprehensive code relationship analysis

📊 Performance Benchmarks

This release includes comprehensive performance benchmarks against:

  • Node.js applications
  • Django applications
  • Spring Boot applications
  • Real-world vulnerable applications from validation-benchmarks

🎯 Focus Areas

  • Code relationship analysis - enhanced understanding of function calls and references
  • Multi-language support - expanded coverage including PHP and Terraform
  • Performance optimization - faster analysis for large codebases
  • Developer experience - improved CLI and configuration options

This release significantly enhances Parsentry's code analysis capabilities with comprehensive call graph construction, improved language support, and performance optimizations for enterprise-scale security analysis.